hippo-memory 1.63.2 → 1.64.0

package/README.md

@@ -827,11 +827,11 @@ The block asks for nothing a hook already does, because each extra tool call re-
 
 For Claude Code, it also adds 7 hook entries to `~/.claude/settings.json`:
 - a `SessionEnd` hook that runs `hippo sleep` and then `hippo capture` when the session exits. Capture matches the last 20 user and 10 assistant messages of the transcript against word patterns for decisions, rules, errors and preferences. It uses no model and does not read earlier turns, so record lessons with `hippo remember` as you go.
-- a `SessionStart` hook that prints the previous session's consolidation output
+- a `SessionStart` hook that prints the previous session's consolidation log on stderr, where `claude --debug` shows it. When the last sleep failed or a compaction summary was set aside, it shows you one line that points to `hippo doctor`.
 - a `UserPromptSubmit` hook that runs `hippo context --pinned-only --include-recent 5 --format additional-context` every turn. It re-injects pinned memories (`hippo remember <text> --pin`) plus up to 5 memories that share words with your prompt. When nothing matches, it adds only the pinned ones. Since 1.55.0 this replaces the 5 newest memories, which cut the median block from 847 to 533 tokens in our eval. `{"pinnedInject":{"promptRecall":false}}` brings back the 5 newest, so fresh same-session lessons appear on the next prompt whatever you ask. The block is rendered without live strength percentages, so it stays byte-identical while its memories do not change, and it is sent only when it changed since the session's last prompt: an unchanged block is skipped, resent every 10 skips (`pinnedInject.refreshTurns`, `0` never resends) and resent after compaction. The prompt-matched memories go in a separate block that is never skipped, so they are sent on every prompt they match. `{"pinnedInject":{"skipUnchanged":false}}` sends the pinned block every turn as before. Opt out entirely with `{"pinnedInject":{"enabled":false}}` in `.hippo/config.json`.
 - a `PreCompact` hook that runs `hippo pre-compact` before the transcript gets summarized. It records the compaction in the store, saves a working-state snapshot (task/summary/next step) so mid-session compaction can't drop it, and asks the summariser to end its summary with a "Memories for hippo" list: the lessons, decisions and corrections from the session that should outlive it. The `SessionEnd` hook still owns extracting durable memories from the transcript.
 - a second `SessionStart` hook (matcher `compact`) that runs `hippo compact-resume`, printing that snapshot back into context right after compaction, if it is under 15 minutes old.
-- a `PostCompact` hook that runs `hippo post-compact`. It keeps the summary in the store with secrets scrubbed, and saves each item of that list as a memory that sleep never deletes: at most 10 per compaction, skipping an item an earlier compaction already saved and any item that looks like a secret. An item over 500 characters stays in the compaction's record only. It then prints one line, such as "Hippo saved 3 memories from this compaction and restored your task snapshot." If the store is busy, the summary waits in the store's `compactions-spool/` folder and `hippo sleep` finishes the save; `hippo doctor` names any compaction left unfinished for over 10 minutes. The session that compacted does not have those memories injected back into its own prompts, since it just read them in the summary; `hippo recall` still finds them. The hook prints nothing when there is no store to save to.
+- a `PostCompact` hook that runs `hippo post-compact`. It keeps the summary in the store with secrets scrubbed, and saves each item of that list as a memory that sleep never deletes: at most 10 per compaction, skipping an item an earlier compaction already saved and any item that looks like a secret. An item over 500 characters stays in the compaction's record only. It then prints one line, such as "Hippo saved 3 memories from this compaction and restored your task snapshot." If the store is busy, the summary waits in the store's `compactions-spool/` folder and `hippo sleep` finishes the save; `hippo doctor` names any compaction left unfinished for over 10 minutes. It also counts spool files that are waiting, stale (left by a replay that stopped) or set aside as `.bad`. The session that compacted does not have those memories injected back into its own prompts, since it just read them in the summary; `hippo recall` still finds them. The hook prints nothing when there is no store to save to.
 - a `PostToolUseFailure` hook that runs `hippo capture-error`, which stores a failed tool call as an error memory. It skips interrupts, declined permissions and searches that found nothing, and stores a repeated failure once. It also logs every failure, stored or not, for `hippo failures`: the session, the tool and hashes of the error, never its text. A hash is not anonymous, since anyone who guesses an error's text can check it against the hash. The log keeps 90 days.
 
 Only Claude Code saves memories at a compaction: hippo installs no `PreCompact` or `PostCompact` hook for Codex, Cursor, OpenCode, OpenClaw or Pi.
@@ -893,6 +893,12 @@ No global install needed: `"command": "npx", "args": ["-y", "hippo-memory", "mcp
 
 Exposes 13 tools: `hippo_recall`, `hippo_assemble`, `hippo_drill`, `hippo_remember`, `hippo_outcome`, `hippo_context`, `hippo_status`, `hippo_learn`, `hippo_conflicts`, `hippo_resolve`, `hippo_share`, `hippo_peers`, `hippo_predict_baserate`.
 
+On a store whose `config.json` sets `"sharedStore": true`, `hippo serve` answers MCP at `POST /mcp`, and each request names the caller's repo in two headers: `X-Hippo-Project` and an optional comma-separated `X-Hippo-Project-Aliases` (at most 10). The client percent-encodes each name, so any lowercase Unicode name fits. The server answers 400 for either header sent twice, aliases with no project, a blank, padded or uppercase name, a colon, a name over 256 characters, or a bad percent escape; a bad key still gets 401 first. With a project, `hippo_remember` stamps it on the row, and recall, assemble, drill, context and conflicts show only that project's rows and user-global ones; `hippo_outcome` rates only the recall made under that project. Without one, every tool returns an `isError` refusal that names the header, except `hippo_predict_baserate`. `hippo_learn`, `hippo_share`, `hippo_resolve` and `hippo_peers` are off on a shared store whatever the headers say; the admin resolves conflicts with the CLI. All headers must fit Node's 16 KB limit, and a larger request gets 431. Other stores ignore both headers. Every `/mcp` reply from any store, errors included, carries `X-Hippo-Project-Scoped: 1`, so a client can tell this server reads the project headers where an older one silently ignores them; `hippo-memory/project-identity` exports the name as `MCP_PROJECT_SCOPED_HEADER`.
+
+The headers are a filter the caller picks, not access control: any member key can name another project. The tenant is the security boundary, and binding a key to its projects is a backlog item.
+
+`hippo_peers` reads the server user's own global store, never the repos that share this one, which is why a shared store turns it off.
+
 ### OpenClaw Plugin
 
 Native plugin with auto-context injection, workspace-aware memory lookup, and
@@ -967,7 +973,7 @@ The AI-memory category matured fast in 2026. Hippo's specific take (bio-decay, s
 | Auto-hook install | Yes | No | No | No | No | No | No | No | No | No |
 | MCP server | Yes | Yes | Yes (hosted, needs an account) | Yes | Yes (stdio + HTTP/OAuth) | Yes (hosted, needs an account) | Yes (hosted, needs an API key) | Yes (first-party Claude/LangGraph) | Yes | ? |
 | Zero runtime deps | Yes | No (ChromaDB) | No | No | No (PGLite or PG+pgvector) | No (managed service) | No (npm deps) | No (Python deps) | Yes (single Rust binary) | No (managed + OSS) |
-| LongMemEval (best published) | 98.0% local / 99.8% voyage any-evidence R@5; 88.5% local all-evidence R@5 (s_cleaned, per-haystack)\* | 96.6% raw / 100% reranked R@5 | 94.4 (hosted platform)\*\* | N/A | 95.53% all-evidence R@5 reranked, 93.19% without (s_cleaned\*) | 90.2% accuracy\*\* (LoCoMo 94.7%) | N/A | N/A | 88.78% overall accuracy w/ reader\*\* | 83.00% overall\*\* (LoCoMo 93.05%, HaluMem 93.04%) |
+| LongMemEval (best published) | 98.0% any / 88.5% all R@5\* (local MiniLM; 99.8% any-evidence with voyage-3-large; s_cleaned, per-haystack) | 96.6% raw / 100% reranked R@5 | 94.4 (hosted platform)\*\* | N/A | 95.53% all R@5\* (paid reranker; 93.19% without; s_cleaned) | 90.2% accuracy\*\* (LoCoMo 94.7%) | N/A | N/A | 88.78% accuracy\*\* (overall, with a reader) | 83.00% accuracy\*\* (overall; LoCoMo 93.05%, HaluMem 93.04%) |
 | Git-friendly | Yes | No | No | Yes | Yes | No | Yes (memory tracked in git) | No | Yes (Git is the model) | ? |
 | Framework agnostic | Yes | Yes | Partial | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
 | License | MIT | (open) | Apache-2.0 | (open) | MIT | Proprietary cloud (Graphiti: Apache-2.0) | Apache-2.0 | MIT (core) | Apache-2.0 | Apache-2.0 (OSS) + cloud |
@@ -1157,7 +1163,7 @@ The interesting problems:
 
 Hippo is open core. This repository provides the MIT core for individual developers and self-hosted teams: the CLI, the MCP server, supported hooks and adapters, connectors, the dashboard, tenants, API keys, admin/member roles, per-key scope grants and the audit log. Automatic capture and delivery depend on the configured integration; the all-agent low-touch acceptance work remains planned. Code published here stays MIT and stays here.
 
-The commercial edition is planned; its private repository is a scaffold, not a released enterprise product. It is intended for larger companies as a separate package under a commercial licence from KITFUNSO LTD. Planned capabilities include SSO (OIDC and SAML sign-in), SCIM, organisation/team/project policy, an org admin view, the pilot report and telemetry join, SIEM export of the audit log, offline licence keys, hosted SaaS, and support with an SLA. Pull requests implementing those commercial features belong there; see [CONTRIBUTING.md](CONTRIBUTING.md). Release availability and independently verified benefit are separate milestones in the [roadmap](https://github.com/kitfunso/hippo-memory/blob/master/ROADMAP.md#current-execution-index).
+The commercial edition is planned; its private repository is a scaffold, not a released enterprise product. It is intended for larger companies as a separate package under a commercial licence from KITFUNSO LTD. Planned capabilities include SSO (OIDC and SAML sign-in), SCIM, organisation/team/project policy, an org admin view, the pilot report and telemetry join, SIEM export of the audit log, offline licence keys, serving agent hooks to laptops that keep no store of their own, hosted SaaS, and support with an SLA. Pull requests implementing those commercial features belong there; see [CONTRIBUTING.md](CONTRIBUTING.md). Release availability and independently verified benefit are separate milestones in the [roadmap](https://github.com/kitfunso/hippo-memory/blob/master/ROADMAP.md#current-execution-index).
 
 ## License
 

package/dist/agent-memories/claude-code.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { realpathOrResolve, resolveProjectIdentity } from '../project-identity.js';
 import { isStringValue } from '../capture-contract.js';
-import { isJsonObject } from '../hooks/shared.js';
+import { claudeConfigDir, isJsonObject } from '../hooks/shared.js';
 import { expandHome, frontmatterField, itemTime, readTextFile, splitFrontmatter } from './files.js';
 import { markdownNotes, readFolderStore, uniqueFolders } from './folder-store.js';
 import { gitLayout } from './git.js';
@@ -39,7 +39,7 @@ export function claudeFolderName(root) {
 export const claudeCodeAdapter = {
     tool: 'claude-code',
     list(ctx, scope) {
-        const config = ctx.env.CLAUDE_CONFIG_DIR || path.join(ctx.home, '.claude');
+        const config = claudeConfigDir(ctx.home, ctx.env);
         const warnings = [];
         const folders = scope === 'project' ? projectFolders(ctx, config) : userFolders(ctx, config, warnings);
         return { tool: 'claude-code', home: config, containers: readFolders(folders, scope, ctx.platform), warnings };
@@ -47,7 +47,7 @@ export const claudeCodeAdapter = {
 };
 /** A session's own notes folder and nothing else, with no git call, so post-compact can read it inside the hook's time limit. */
 export function claudeTranscriptListing(ctx, transcriptPath) {
-    const config = ctx.env.CLAUDE_CONFIG_DIR || path.join(ctx.home, '.claude');
+    const config = claudeConfigDir(ctx.home, ctx.env);
     const folder = path.join(path.dirname(transcriptPath), 'memory');
     return { tool: 'claude-code', home: config, containers: readFolders([folder], 'project', ctx.platform), warnings: [] };
 }

package/dist/ambient-store.d.ts

@@ -2,6 +2,8 @@ import { type AmbientTallies } from './ambient.js';
 /** The rows an ambient summary describes: a context read's envelope, origin partition and tag secret veto. */
 export interface AmbientStoreFilter {
     exactScope?: string;
+    /** The reader's personal scope, which the default deny admits. */
+    ownScope?: string;
     /** Rows carrying one of these project names, and user-global rows, pass; absent admits every origin. */
     project?: readonly string[];
     /** The reader's project names: a secret-tagged row counts only inside its own non-empty origin project. */

package/dist/ambient-store.js

@@ -1,6 +1,6 @@
 import { closeHippoDb } from './db.js';
 import { strengthSql } from './memory.js';
-import { RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
+import { scopeAdmitSql } from './recall-scope.js';
 import { SECRET_TAGS } from './secret-detect.js';
 import { openStore } from './store/open.js';
 import { originInSql } from './project-identity.js';
@@ -16,8 +16,9 @@ function contextRowsWhere(tenantId, filter) {
         params.push(filter.exactScope);
     }
     else {
-        where.push(`(scope IS NULL OR (scope NOT IN (${RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ')}) AND scope NOT LIKE '%:private:%'))`);
-        params.push(...RECALL_DEFAULT_DENY_SCOPES);
+        const admit = scopeAdmitSql('', filter.ownScope);
+        where.push(admit.sql);
+        params.push(...admit.params);
     }
     if (filter.project !== undefined) {
         where.push(`(origin_project = '' OR ${originInSql(filter.project)})`);

package/dist/api/assemble.d.ts

@@ -1,3 +1,4 @@
+import type { CallerProject } from '../prompt-hook.js';
 import type { Context } from './types.js';
 export declare const DEFAULT_ASSEMBLE_BUDGET = 4000;
 export interface AssembleOpts {
@@ -23,6 +24,7 @@ export interface AssembleOpts {
      */
     rowCap?: number;
     cost?: AssembleCost;
+    project?: CallerProject;
 }
 export interface AssembleCost {
     item: (it: AssembledContextItem) => number;

package/dist/api/assemble.js

@@ -1,7 +1,8 @@
 // Session context assembly under a token budget.
 import { loadEntriesByIds, loadSessionRawMemories, countSessionRawMemories } from '../store/entry-reads.js';
 import { estimateTokens } from '../token-ledger.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed } from '../recall-scope.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../recall-scope.js';
+import { classifyOriginProject, projectNames } from '../project-identity.js';
 export const DEFAULT_ASSEMBLE_BUDGET = 4000;
 /**
  * Build a chronologically-ordered context window for a session. Adapts the
@@ -31,18 +32,20 @@ export function assemble(ctx, sessionId, opts = {}) {
     const freshTailCount = opts.freshTailCount ?? 10;
     const summarizeOlder = opts.summarizeOlder ?? true;
     const rowCap = opts.rowCap ?? 5000;
+    const own = personalScopeOf(ctx.actor) ?? undefined;
     if (!sessionId) {
         return { sessionId, items: [], tokens: 0, totalRaw: 0, summarized: 0, evicted: 0, truncated: false };
     }
-    const rows = loadSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, rowCap);
+    const origins = opts.project ? projectNames(opts.project) : undefined;
+    const rows = loadSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, rowCap, origins);
     const truncated = rows.length === rowCap;
     // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
-    const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope));
+    const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope, own));
     let totalRaw;
     if (truncated) {
         // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
         // caller cannot infer private rows by comparing totalRaw to items.length.
-        totalRaw = countSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, opts.scope);
+        totalRaw = countSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, opts.scope, own, origins);
     }
     else {
         totalRaw = scoped.length;
@@ -56,7 +59,7 @@ export function assemble(ctx, sessionId, opts = {}) {
     const tailRows = scoped.slice(tailStartIdx);
     // Substitute parent summaries for older rows that share one.
     const { olderItems, summarized } = summarizeOlder && olderRows.length > 0
-        ? substituteSummaries(ctx, olderRows, opts.scope)
+        ? substituteSummaries(ctx, olderRows, opts.scope, own, opts.project)
         : { olderItems: olderRows.map(rawItem), summarized: 0 };
     const tailItems = tailRows.map((r) => ({
         id: r.id,
@@ -83,7 +86,7 @@ function rawItem(r) {
         strength: r.strength,
     };
 }
-function substituteSummaries(ctx, olderRows, scope) {
+function substituteSummaries(ctx, olderRows, scope, own, project) {
     const olderItems = [];
     let summarized = 0;
     const olderByParent = new Map();
@@ -98,7 +101,8 @@ function substituteSummaries(ctx, olderRows, scope) {
     const parents = eligibleParentIds.length > 0
         ? loadEntriesByIds(ctx.hippoRoot, eligibleParentIds, ctx.tenantId)
             .filter((p) => (p.dag_level ?? 0) === 2 && !p.superseded_by)
-            .filter((p) => passesScopeFilterForRecall(p.scope ?? null, scope))
+            .filter((p) => passesScopeFilterForRecall(p.scope ?? null, scope, own))
+            .filter((p) => !project || classifyOriginProject(p.origin_project, project) !== 'cross-project')
         : [];
     const claimedRawIds = new Set();
     for (const parent of parents) {

package/dist/api/auth.d.ts

@@ -30,6 +30,19 @@ export interface AuthCreateResult {
  * outranks its minter: a resolver admin is tenant-only, so it mints members.
  */
 export declare function authCreate(ctx: Context, opts: AuthCreateOpts): AuthCreateResult;
+export interface AuthCreateSelfOpts {
+    label?: string;
+    /** Days until the new key expires. */
+    ttlDays: number;
+    /** Live self-minted keys one subject may hold; minting past it revokes the oldest. */
+    perSubject: number;
+}
+export interface AuthCreateSelfResult extends AuthCreateResult {
+    /** ISO time the key stops working. */
+    expiresAt: string;
+}
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
+export declare function authCreateSelf(ctx: Context, opts: AuthCreateSelfOpts): AuthCreateSelfResult;
 /**
  * List API keys visible to the calling tenant.
  *
@@ -47,21 +60,12 @@ export declare function authListRows(ctx: Context, opts: {
     limit?: number;
     after?: KeysetPosition;
 }): ApiKeyListRow[];
-/**
- * Revoke an API key.
- *
- * Security: the key must belong to `ctx.tenantId`. Cross-tenant revoke is
- * rejected with the "not found" message used for missing keys, and a member may
- * revoke only its own key (checked first), so no caller can probe other key_ids.
- *
- * Audit: emits 'auth_revoke' with `tenantId` set to the KEY ROW's tenant_id
- * (mirrors src/cli.ts:cmdAuthRevoke). Skipped on no-op
- * revoke (already revoked) so re-running doesn't pad the audit log.
- */
 export interface AuthRevokeResult {
     ok: true;
     revokedAt: string;
 }
+/** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
+ *  The auth_revoke row carries the KEY ROW's tenant, as cmdAuthRevoke does, and is skipped for an already-revoked key. */
 export declare function authRevoke(ctx: Context, keyId: string): AuthRevokeResult;
 /**
  * The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,

package/dist/api/auth.js

@@ -2,9 +2,30 @@
 import { openHippoDb, closeHippoDb } from '../db.js';
 import { BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../api-errors.js';
 import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
-import { createApiKey, listApiKeyRows, revokeApiKey, grantScope, ungrantScope } from '../auth.js';
+import { createApiKey, listApiKeyRows, listLiveOwnedKeyIds, revokeApiKey, grantScope, ungrantScope } from '../auth.js';
+import { DAY_MS } from '../dashboard-snapshot.js';
 import { isRestrictedScope } from '../recall-scope.js';
 import { selectApiKeyOwner } from '../store/tenant-lookup.js';
+const API_KEY_SUBJECT = 'api_key:';
+/** The key id an API-key actor's subject names, or null for any other actor. */
+function keyIdOfSubject(subject) {
+    return subject.startsWith(API_KEY_SUBJECT) ? subject.slice(API_KEY_SUBJECT.length) : null;
+}
+function inTransaction(db, fn) {
+    db.exec('BEGIN IMMEDIATE');
+    try {
+        const out = fn();
+        db.exec('COMMIT');
+        return out;
+    }
+    catch (err) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { /* keep the original error */ }
+        throw err;
+    }
+}
 /**
  * Mint a new API key. The new key is ALWAYS bound to `ctx.tenantId`. Callers
  * cannot override the tenant via the opts bag — a previous `tenantId` field
@@ -26,20 +47,23 @@ export function authCreate(ctx, opts) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
         const role = opts.role ?? (ctx.actor.viaAuthResolver ? 'member' : 'admin');
-        const result = createApiKey(db, { tenantId: ctx.tenantId, label: opts.label, role });
-        // Same try/catch as authRevoke so audit failure can't crash a successful mint.
+        const mint = () => createApiKey(db, { tenantId: ctx.tenantId, label: opts.label, role });
         // The plaintext is NEVER logged; metadata carries label + role, keyId is non-secret.
-        try {
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'auth_create',
-                targetId: result.keyId,
-                metadata: {
-                    label: opts.label ?? null,
-                    role,
-                },
+        const audit = (keyId) => appendAuditEvent(db, {
+            tenantId: ctx.tenantId, actor: ctx.actor.subject, op: 'auth_create', targetId: keyId, metadata: { label: opts.label ?? null, role },
+        });
+        // A resolver admin's keys are found again only through their audit rows, so the key and its row commit together.
+        if (ctx.actor.viaAuthResolver) {
+            const result = inTransaction(db, () => {
+                const minted = mint();
+                audit(minted.keyId);
+                return minted;
             });
+            return { keyId: result.keyId, plaintext: result.plaintext, tenantId: ctx.tenantId, role };
+        }
+        const result = mint();
+        try {
+            audit(result.keyId);
         }
         catch (error) {
             // Audit must not crash a successful mint.
@@ -51,6 +75,49 @@ export function authCreate(ctx, opts) {
         closeHippoDb(db);
     }
 }
+const MAX_TTL_DAYS = 3650;
+/** A RangeError, not a 4xx, since the operator's config sets these; the ttl ceiling keeps toISOString in range and a departed user's key short-lived. */
+function assertSelfMintOpts({ ttlDays, perSubject }) {
+    if (!Number.isFinite(ttlDays) || ttlDays <= 0 || ttlDays > MAX_TTL_DAYS) {
+        throw new RangeError(`authCreateSelf: ttlDays must be above 0 and at most ${MAX_TTL_DAYS}, got ${String(ttlDays)}`);
+    }
+    if (!Number.isInteger(perSubject) || perSubject < 1) {
+        throw new RangeError(`authCreateSelf: perSubject must be a whole number of at least 1, got ${String(perSubject)}`);
+    }
+}
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
+export function authCreateSelf(ctx, opts) {
+    if (!ctx.actor.viaAuthResolver) {
+        throw new ForbiddenError('Only a caller signed in through the auth resolver can mint its own key');
+    }
+    assertSelfMintOpts(opts);
+    const { tenantId, actor: { subject } } = ctx;
+    const now = Date.now();
+    const expiresAt = new Date(now + opts.ttlDays * DAY_MS).toISOString();
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        // IMMEDIATE takes the write lock before the count, so two mints for one subject cannot both see room under the cap.
+        const result = inTransaction(db, () => {
+            const live = listLiveOwnedKeyIds(db, tenantId, subject, now);
+            const replaced = live.slice(0, Math.max(0, live.length - opts.perSubject + 1));
+            const minted = createApiKey(db, { tenantId, label: opts.label, role: 'member', ownerSubject: subject, expiresAt });
+            for (const keyId of replaced) {
+                revokeApiKey(db, keyId);
+                appendAuditEvent(db, { tenantId, actor: subject, op: 'auth_revoke', targetId: keyId, metadata: { replacedBy: minted.keyId } });
+            }
+            // Same op and actor as an admin mint, so a lookup by audit row finds this key too.
+            appendAuditEvent(db, {
+                tenantId, actor: subject, op: 'auth_create', targetId: minted.keyId,
+                metadata: { label: opts.label ?? null, role: 'member', self: true, expiresAt },
+            });
+            return minted;
+        });
+        return { keyId: result.keyId, plaintext: result.plaintext, tenantId, role: 'member', expiresAt };
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 /**
  * List API keys visible to the calling tenant.
  *
@@ -66,26 +133,50 @@ export function authList(ctx, opts) {
 export function authListRows(ctx, opts) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        return listApiKeyRows(db, { ...opts, tenantId: ctx.tenantId });
+        const filter = memberListFilter(db, ctx);
+        return filter === null ? [] : listApiKeyRows(db, { ...opts, tenantId: ctx.tenantId, ...filter });
     }
     finally {
         closeHippoDb(db);
     }
 }
+/** A member sees only the keys its person minted, or just its own key when that has no owner; an admin sees the whole tenant; null means no keys. */
+function memberListFilter(db, ctx) {
+    const { actor } = ctx;
+    if (actor.role === 'admin')
+        return {};
+    if (actor.viaAuthResolver)
+        return { ownerSubject: actor.subject };
+    const keyId = keyIdOfSubject(actor.subject);
+    if (keyId === null)
+        return null;
+    const owner = selectApiKeyOwner(db, keyId)?.ownerSubject;
+    return owner ? { ownerSubject: owner } : { keyId };
+}
+/** Throws unless `ctx` may revoke `keyId`; a member gets one answer for a missing, foreign or unowned key, so it cannot probe key ids. */
+function assertMayRevoke(ctx, keyId, row) {
+    const { actor } = ctx;
+    if (actor.role !== 'admin' && actor.viaAuthResolver && (row?.tenantId !== ctx.tenantId || row.ownerSubject !== actor.subject)) {
+        throw new ForbiddenError('A member can revoke only the keys it minted');
+    }
+    // Cross-tenant access denied: same message as missing key, no info leak.
+    if (!row || row.tenantId !== ctx.tenantId) {
+        throw new NotFoundError(`Unknown key_id: ${keyId}`);
+    }
+    if (actor.viaAuthResolver && row.role === 'admin') {
+        throw new ForbiddenError('An auth resolver admin cannot revoke an admin key, which outranks it');
+    }
+}
+/** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
+ *  The auth_revoke row carries the KEY ROW's tenant, as cmdAuthRevoke does, and is skipped for an already-revoked key. */
 export function authRevoke(ctx, keyId) {
-    if (ctx.actor.role !== 'admin' && ctx.actor.subject !== `api_key:${keyId}`) {
+    if (ctx.actor.role !== 'admin' && !ctx.actor.viaAuthResolver && keyIdOfSubject(ctx.actor.subject) !== keyId) {
         throw new ForbiddenError('A member key can revoke only itself');
     }
     const db = openHippoDb(ctx.hippoRoot);
     try {
         const row = selectApiKeyOwner(db, keyId);
-        // Cross-tenant access denied: same message as missing key, no info leak.
-        if (!row || row.tenantId !== ctx.tenantId) {
-            throw new NotFoundError(`Unknown key_id: ${keyId}`);
-        }
-        if (ctx.actor.viaAuthResolver && row.role === 'admin') {
-            throw new ForbiddenError('An auth resolver admin cannot revoke an admin key, which outranks it');
-        }
+        assertMayRevoke(ctx, keyId, row);
         let revokedAt;
         let alreadyRevoked = false;
         if (row.revokedAt) {
@@ -153,6 +244,9 @@ function changeScopeGrant(ctx, keyId, scope, op) {
         if (op === 'auth_grant' && row.revokedAt) {
             throw new ConflictError(`${keyId} is revoked; a grant on it would never apply`);
         }
+        if (op === 'auth_grant' && /^personal:/i.test(scope)) {
+            throw new BadRequestError(`${scope} is a personal scope: only its owner reads it, and no grant can change that`);
+        }
         if (!isRestrictedScope(scope)) {
             throw new BadRequestError(`${scope} is not a restricted scope; it is already readable by default`);
         }

package/dist/api/context-select.d.ts

@@ -12,12 +12,15 @@ export interface ContextPlan {
     includeRecent: number;
     activeScope: string;
     exactScope: string | undefined;
+    /** The caller's personal scope, from its authenticated owner; the default deny admits it. */
+    ownScope: string | undefined;
     query: string;
     hasLocal: boolean;
     hasGlobal: boolean;
     globalRoot: string;
     primaryIsGlobal: boolean;
     hasLocalTaskState: boolean;
+    sharedStore: boolean;
     config: HippoConfig;
     currentProject: ProjectRef;
     includeCrossProject: boolean;
@@ -27,13 +30,12 @@ export interface ContextPlan {
     price: (entry: MemoryEntry, isGlobal: boolean, promptRecall?: boolean) => number;
     obs: DeliveryObserver | undefined;
 }
-/** The ambient admit rules; `digestHidden` is read late because a prompt-recall eligibility check can still set it. */
+/** The ambient admit rules. */
 export interface ContextAdmission {
     ambientAdmit: (e: MemoryEntry) => boolean;
     admit: (e: MemoryEntry) => boolean;
     /** What the two-store search admits: `admit` without the own-session compaction rule. */
     bothStoresAdmit: (e: MemoryEntry) => boolean;
-    digestHidden: () => boolean;
 }
 export interface ContextPools {
     local: AmbientLoadResult;
@@ -41,7 +43,7 @@ export interface ContextPools {
 }
 export declare function oneCopyPerMemory(local: readonly MemoryEntry[], global: readonly MemoryEntry[], now: Date): [MemoryEntry[], MemoryEntry[]];
 export declare const finiteOr: (v: number, dflt: number, min: number) => number;
-/** Pins plus the prompt-recall or recent-N backfill; null means the block is empty. */
+/** Pins plus the prompt-recall or recent-N backfill; null means the hook block is turned off, so task state stays out too. */
 export declare function selectPinned(opts: ContextOpts, plan: ContextPlan, left: number, pools: ContextPools, admission: ContextAdmission): ContextResultEntry[] | null;
 /** No query: the strongest memories by strength, up to budget. */
 export declare function selectStrongest(plan: ContextPlan, left: number, pools: ContextPools): ContextResultEntry[];

package/dist/api/context-select.js

@@ -3,7 +3,8 @@ import { openHippoDb, closeHippoDb } from '../db.js';
 import { recallScopeFilter } from '../store/search-rows.js';
 import { loadIndex } from '../store/index-and-stats.js';
 import { calculateStrength } from '../memory.js';
-import { appendAuditEvent, auditQueryFields, isContentWorthStoring } from '../audit.js';
+import { appendAuditEvent, auditQueryFields } from '../audit.js';
+import { isWorthSurfacing } from '../memory-quality.js';
 import { rankBothStores } from '../shared.js';
 import { evalNow } from '../ablation.js';
 import { hybridSearch } from '../search/hybrid.js';
@@ -34,7 +35,7 @@ export function oneCopyPerMemory(local, global, now) {
     return [local.filter((e) => kept.has(e)), global.filter((e) => kept.has(e))];
 }
 export const finiteOr = (v, dflt, min) => Number.isFinite(v) && v >= min ? v : dflt;
-/** Pins plus the prompt-recall or recent-N backfill; null means the block is empty. */
+/** Pins plus the prompt-recall or recent-N backfill; null means the hook block is turned off, so task state stays out too. */
 export function selectPinned(opts, plan, left, pools, admission) {
     const { obs, primaryIsGlobal, config: pinnedCfg } = plan;
     if (!pinnedCfg.pinnedInject.enabled) {
@@ -65,12 +66,6 @@ export function selectPinned(opts, plan, left, pools, admission) {
     else if (plan.includeRecent > 0) {
         backfillRecent(plan, localPool, globalPool, picked, recentBudget, nowP);
     }
-    if (pinnedLocal.length === 0 &&
-        pinnedGlobal.length === 0 &&
-        picked.items.length === 0 &&
-        !admission.digestHidden()) {
-        return null;
-    }
     admitWithinBudget(rankedPinned, picked, effBudget, obs);
     return picked.items;
 }
@@ -155,7 +150,7 @@ function promptRecallCandidates(plan, pools, admit, rankedPinned, nowP) {
     const pinnedText = new Set(rankedPinned.map((r) => r.entry.content));
     const ineligibleReason = (e) => !admit(e) ? 'scope'
         : e.pinned ? 'pinned'
-            : !isContentWorthStoring(e.content) ? 'quality'
+            : !isWorthSurfacing(e) ? 'quality'
                 : pinnedText.has(e.content) ? 'duplicate'
                     : null;
     const eligible = (e) => {
@@ -199,7 +194,7 @@ function backfillRecent(plan, localPool, globalPool, picked, recentBudget, nowP)
     })
         // Filter before slice so a junk row is backfilled past, not counted against N. Pins bypass the floor: a dropped
         // pin's share of the shared budget would go to a backfilled row, and the pin loop could not win it back.
-        .filter(({ entry }) => entry.pinned || isContentWorthStoring(entry.content))
+        .filter(({ entry }) => entry.pinned || isWorthSurfacing(entry))
         .slice(0, plan.includeRecent)
         .map(({ entry, isGlobal }) => ({
         entry,
@@ -271,7 +266,7 @@ async function searchBothStores(ctx, plan, left, minResults, pools, admit) {
 }
 /** The vector arm under the lexical window's own tenant, scope and current-row rules. */
 function contextVectorSpec(ctx, plan, admit) {
-    return { tenantId: ctx.tenantId, scope: recallScopeFilter(plan.exactScope, 'exact'), includeSuperseded: false, admit };
+    return { tenantId: ctx.tenantId, scope: recallScopeFilter(plan.exactScope, 'exact', plan.ownScope), includeSuperseded: false, admit };
 }
 async function searchLocalRows(ctx, plan, left, minResults, localEntries, admit) {
     const { cost, price, primaryIsGlobal, query, config: ctxConfig } = plan;

package/dist/api/context-types.d.ts

@@ -25,7 +25,7 @@ export interface ContextOpts {
     /** Envelope scope to match exactly, as in `recall`: admits that scope even when private, after the actor's scope check. */
     exactScope?: string;
     /** With `pinnedOnly`, also inject the N most recent writes that pass the
-     *  quality floor (`isContentWorthStoring`). Filtering happens BEFORE
+     *  quality floor (`isWorthSurfacing`). Filtering happens BEFORE
      *  the take-N, so a caller asking for 5 gets 5 qualifying entries rather
      *  than 5-minus-junk; pinned entries bypass the floor. Entries are only
      *  skipped for this read, never mutated or deleted. Ignored when
@@ -55,6 +55,7 @@ export interface ContextOpts {
     cost?: ContextCost;
     /** @internal The CLI's delivery-ledger observer; it only reads, so selection is the same with or without it. */
     deliveryObserver?: DeliveryObserver;
+    sharedStore?: true;
 }
 /** Budget prices in the text a caller prints, so the budget bounds what reaches the model. */
 export interface ContextCost {

package/dist/api/context.d.ts

@@ -1,7 +1,7 @@
 import { type MemoryEntry } from '../memory.js';
 import { type ProjectRef } from '../project-identity.js';
 import type { ContextOpts, ContextResult } from './context-types.js';
-import type { Context } from './types.js';
+import { type Context } from './types.js';
 export { oneCopyPerMemory } from './context-select.js';
 /**
  * The secret half of the ambient policy on its own, for callers